Modern Warfare 3 Source Code / Address Thread

[cucuYeL]

Some structs..

typedef struct
{
	char unknown0[12];
	char Name[16];
	__int32 Team;
}ClientInfo_T;

typedef struct
{
	char _0x0000[0x8];
	int Width;
	int Height;
	int FovX;
	int FovY;
	Vector Origin;
	Vector ViewAxis[3];
	char _0x0048[0x24];
	float ZoomProgress;
	char _0x0070[0x4ABC]; 
	Vector ViewAngles;
	char _0x4B34[0x30];
	float WeaponViewAngleX;
	float WeaponViewAngleY;
}RefDef_T;

typedef struct
{
public:
       Vector Recoil;
       Vector vOrigin;
       Vector DeltaOrigin; 
       float ReadViewAngleY;
       float ReadViewAngleX;
       char _0x0070[108];
       float SetViewAngleY;
       float SetViewAngleX; 
} ViewMatrix;

typedef struct
{
	char _0x0000[0x2];                         
	short Valid;                                   
	char _0x0004[0x10];                        
	Vector Origin;                                
	Vector Angles;                              
	char _0x002C[0x3C];                      
	int Flags;                                  
	char _0x006C[0xC];                          
	Vector OldOrigin;                           
	char _0x0084[0x18];                         
	Vector OldAngles;                        
	char _0x00A8[0x28];                     
	int ClientNumber;                                 
	short Type;                            
	char _0x00D6[0x12];                          
        Vector NewOrigin;   
	char _0x00F4[0x1C];                        
	Vector NewAngles;                            
	char _0x011C[0x7C];                      
	byte WeaponID;                            
	char _0x0199[0x37];                    
	int IsAlive; 
	char _0x01D4[0x24];
}Entity_T; 

typedef struct
{
    int servertime; 
    int playerstate; 
    int staminatimer; 
    unsigned short playerstance;
    char _pad[10];
    int velocity; 
    Vector Origin;
    Vector Velocity;
    char _pad1[44];
    float refdefViewAngleY; 
    float refdefViewAngleX; 
    char _pad2[232];
    int ClientNumber; 
    char _pad3[4];
    float viewAngleY;
    float viewAngleX; 
    char _pad4[4];
    int   playerStanceInt; 
    float playerStanceFlt;
    char _pad5[80];
    int MaxEntities;
    char _pad6[432];
    int WeaponNum;
    unsigned short EquipmentState;
    unsigned short WeaponSwapState;
    float WeaponZoomFlt;
    float MovementSpreadMultiplier;
    char _pad7[4];
    float DefaultSpreadMultiplier;
    int  WeaponState;
    char _pad8[352];
    BYTE perkslot3;
    char _pad9[19];
}CG_T;

typedef struct
{
public:
	__int32 Time;
	char unknown0[512];
	__int32 Uav;
	char unknown1[384];
	__int32 SpreadValue;
}CGS_T;

Is this for Tekno or IW5M?

[Kenshin13]

Is this for Tekno or IW5M?

Both. They are, after all, running on the same version.

[Kenshin13]

For you @mwxplayer

//Draw Exception
DVAR_SIZE: 0xC
cg_hudChatPosition_DVar:  8B 3D ?? ?? ?? ?? D9 47 0C  (P) -> 8FAAFC
cg_hudChatPosition_ExceptionAddr:  D9 47 0C E8 ?? ?? ?? ?? D9 47 10  (N) -> 588567
//IN_CreateCnd Exception:
cl_pitchspeed_DVar:  8B 0D ?? ?? ?? ?? D9 41 0C D9 5C 24 04 D9 44 24 04  (P) -> B39EDC
cl_pitchspeed_ExceptionAddr:  D9 41 0C D9 5C 24 04 D9 44 24 04 D8 D1  (N) -> 5AF997
//WritePacket Eception
cl_packetdup_DVar:  8B 0D ?? ?? ?? ?? 2B 41 0C 57 (P) -> 1060190
cl_packetdup_ExceptionAddr:  2B 41 0C 57 8B 3D  (N) -> 420BE9

Hopefully you know how to use exceptions.
Credits: godly

[mwxplayer]

How to Find DrawXModelSkincached offset.

Search for "R_AddXModelSurfacesCamera" String.

CPU Disasm
Address   Hex dump          Command                                  Comments
00413C80  /$  83EC 28       SUB ESP,28
00413C83  |.  8B4424 2C     MOV EAX,DWORD PTR SS:[ARG.1]
00413C87  |.  0FB610        MOVZX EDX,BYTE PTR DS:[EAX]
00413C8A  |.  0FB748 02     MOVZX ECX,WORD PTR DS:[EAX+2]
00413C8E  |.  53            PUSH EBX
00413C8F  |.  8B5C24 34     MOV EBX,DWORD PTR SS:[ARG.2]
00413C93  |.  55            PUSH EBP
00413C94  |.  56            PUSH ESI
00413C95  |.  0FB670 01     MOVZX ESI,BYTE PTR DS:[EAX+1]
00413C99  |.  57            PUSH EDI
00413C9A  |.  895424 30     MOV DWORD PTR SS:[LOCAL.1],EDX
00413C9E  |.  8B15 0076FA05 MOV EDX,DWORD PTR DS:[5FA7600]
00413CA4  |.  8DBC8A 802704 LEA EDI,[ECX*4+EDX+42780]
00413CAB  |.  56            PUSH ESI                                 ; /Arg2
00413CAC  |.  53            PUSH EBX                                 ; |Arg1 => [ARG.2]
00413CAD  |.  894C24 44     MOV DWORD PTR SS:[ARG.1],ECX             ; |
00413CB1  |.  897C24 18     MOV DWORD PTR SS:[LOCAL.9],EDI           ; |
00413CB5  |.  E8 76990F00   CALL 0050D630                            ; \iw5mp.0050D630
00413CBA  |.  8BE8          MOV EBP,EAX
00413CBC  |.  56            PUSH ESI                                 ; /Arg2
00413CBD  |.  53            PUSH EBX                                 ; |Arg1
00413CBE  |.  896C24 44     MOV DWORD PTR SS:[LOCAL.0],EBP           ; |
00413CC2  |.  E8 39800F00   CALL 0050BD00                            ; \iw5mp.0050BD00
00413CC7  |.  8B4C24 70     MOV ECX,DWORD PTR SS:[ARG.10]
00413CCB  |.  83C4 10       ADD ESP,10
00413CCE  |.  803D C0CCF905 CMP BYTE PTR DS:[5F9CCC0],0
00413CD5  |.  894424 28     MOV DWORD PTR SS:[LOCAL.3],EAX
00413CD9  |.  74 0D         JE SHORT 00413CE8
00413CDB  |.  C74424 14 010 MOV DWORD PTR SS:[LOCAL.8],1
00413CE3  |.  F6C1 01       TEST CL,01
00413CE6  |.  75 08         JNE SHORT 00413CF0
00413CE8  |>  C74424 14 000 MOV DWORD PTR SS:[LOCAL.8],0
00413CF0  |>  33D2          XOR EDX,EDX
00413CF2  |.  83F9 01       CMP ECX,1
00413CF5  |.  0F94C2        SETE DL
00413CF8  |.  33DB          XOR EBX,EBX
00413CFA  |.  895C24 24     MOV DWORD PTR SS:[LOCAL.4],EBX
00413CFE  |.  895424 2C     MOV DWORD PTR SS:[LOCAL.2],EDX
00413D02  |.  3BEB          CMP EBP,EBX
00413D04  |.  0F86 03020000 JBE 00413F0D
00413D0A  |.  8B7424 54     MOV ESI,DWORD PTR SS:[ARG.7]
00413D0E  |.  EB 02         JMP SHORT 00413D12
00413D10  |>  33DB          /XOR EBX,EBX
00413D12  |>  8B0F          |MOV ECX,DWORD PTR DS:[EDI]
00413D14  |.  83F9 FD       |CMP ECX,-3
00413D17  |.  75 0C         |JNE SHORT 00413D25
00413D19  |.  FF4424 3C     |INC DWORD PTR SS:[ARG.1]
00413D1D  |.  83C7 04       |ADD EDI,4
00413D20  |.  E9 B2010000   |JMP 00413ED7
00413D25  |>  83F9 FC       |CMP ECX,-4
00413D28  |.  7E 0F         |JLE SHORT 00413D39
00413D2A  |.  C74424 18 080 |MOV DWORD PTR SS:[LOCAL.7],8
00413D32  |.  B9 3C000000   |MOV ECX,3C
00413D37  |.  EB 14         |JMP SHORT 00413D4D
00413D39  |>  C1E1 05       |SHL ECX,5
00413D3C  |.  8BD1          |MOV EDX,ECX
00413D3E  |.  B9 BCFFFFFF   |MOV ECX,-44
00413D43  |.  C74424 18 070 |MOV DWORD PTR SS:[LOCAL.7],7
00413D4B  |.  2BCA          |SUB ECX,EDX
00413D4D  |>  894C24 20     |MOV DWORD PTR SS:[LOCAL.5],ECX
00413D51  |.  8BD0          |MOV EDX,EAX
00413D53  |.  895C24 1C     |MOV DWORD PTR SS:[LOCAL.6],EBX
00413D57  |.  895C24 60     |MOV DWORD PTR SS:[ARG.10],EBX
00413D5B  |.  395C24 14     |CMP DWORD PTR SS:[LOCAL.8],EBX
00413D5F  |.  74 27         |JE SHORT 00413D88
00413D61  |.  8B28          |MOV EBP,DWORD PTR DS:[EAX]
00413D63  |.  8B6D 54       |MOV EBP,DWORD PTR SS:[EBP+54]
00413D66  |.  399D D8000000 |CMP DWORD PTR SS:[EBP+0D8],EBX
00413D6C  |.  74 0F         |JE SHORT 00413D7D
00413D6E  |.  BB 01000000   |MOV EBX,1
00413D73  |.  895C24 1C     |MOV DWORD PTR SS:[LOCAL.6],EBX
00413D77  |.  895C24 60     |MOV DWORD PTR SS:[ARG.10],EBX
00413D7B  |.  EB 0B         |JMP SHORT 00413D88
00413D7D  |>  395C24 2C     |CMP DWORD PTR SS:[LOCAL.2],EBX
00413D81  |.  74 05         |JE SHORT 00413D88
00413D83  |.  BA C4CCF905   |MOV EDX,OFFSET iw5mp.05F9CCC4
00413D88  |>  8B1A          |MOV EBX,DWORD PTR DS:[EDX]
00413D8A  |.  0FB66B 52     |MOVZX EBP,BYTE PTR DS:[EBX+52]
00413D8E  |.  83FD 04       |CMP EBP,4
00413D91  |.  75 10         |JNE SHORT 00413DA3
00413D93  |.  8BD1          |MOV EDX,ECX
00413D95  |.  C1EA 02       |SHR EDX,2
00413D98  |.  015424 3C     |ADD DWORD PTR SS:[ARG.1],EDX
00413D9C  |.  03F9          |ADD EDI,ECX
00413D9E  |.  E9 34010000   |JMP 00413ED7
00413DA3  |>  837C24 60 00  |CMP DWORD PTR SS:[ARG.10],0
00413DA8  |.  74 05         |JE SHORT 00413DAF
00413DAA  |.  BD 02000000   |MOV EBP,2
00413DAF  |>  8B04AE        |MOV EAX,DWORD PTR DS:[EBP*4+ESI]
00413DB2  |.  8B4C24 58     |MOV ECX,DWORD PTR SS:[ARG.8]
00413DB6  |.  3B04A9        |CMP EAX,DWORD PTR DS:[EBP*4+ECX]
00413DB9  |.  0F83 3E010000 |JNB 00413EFD
00413DBF  |.  8B4424 48     |MOV EAX,DWORD PTR SS:[ARG.4]
00413DC3  |.  50            |PUSH EAX                                ; /Arg1 => [ARG.4]
00413DC4  |.  66:8947 0C    |MOV WORD PTR DS:[EDI+0C],AX             ; |
00413DC8  |.  E8 43810100   |CALL 0042BF10                           ; \iw5mp.0042BF10
00413DCD  |.  8B73 0C       |MOV ESI,DWORD PTR DS:[EBX+0C]
00413DD0  |.  83C4 04       |ADD ESP,4
00413DD3  |.  837C24 60 00  |CMP DWORD PTR SS:[ARG.10],0
00413DD8  |.  8947 10       |MOV DWORD PTR DS:[EDI+10],EAX
00413DDB  |.  8B7B 08       |MOV EDI,DWORD PTR DS:[EBX+8]
00413DDE  |.  74 0E         |JE SHORT 00413DEE
00413DE0  |.  8B15 C4CCF905 |MOV EDX,DWORD PTR DS:[5F9CCC4]
00413DE6  |.  8B42 0C       |MOV EAX,DWORD PTR DS:[EDX+0C]
00413DE9  |.  83F7 00       |XOR EDI,00000000
00413DEC  |.  EB 21         |JMP SHORT 00413E0F
00413DEE  |>  8B4424 50     |MOV EAX,DWORD PTR SS:[ARG.6]
00413DF2  |.  68 00000002   |PUSH OFFSET iw5mp.02000000              ; /Arg4 = ASCII "g>i>"
00413DF7  |.  99            |CDQ                                     ; |
00413DF8  |.  6A 00         |PUSH 0                                  ; |Arg3 = 0
00413DFA  |.  52            |PUSH EDX                                ; |Arg2
00413DFB  |.  50            |PUSH EAX                                ; |Arg1 => [ARG.6]
00413DFC  |.  E8 1FEF3100   |CALL 00732D20                           ; \iw5mp.00732D20
00413E01  |.  8BCF          |MOV ECX,EDI
00413E03  |.  2BC8          |SUB ECX,EAX
00413E05  |.  8BC6          |MOV EAX,ESI
00413E07  |.  1BC2          |SBB EAX,EDX
00413E09  |.  33CF          |XOR ECX,EDI
00413E0B  |.  33C9          |XOR ECX,ECX
00413E0D  |.  33F9          |XOR EDI,ECX
00413E0F  |>  33C6          |XOR EAX,ESI
00413E11  |.  25 0000007E   |AND EAX,7E000000
00413E16  |.  33F0          |XOR ESI,EAX
00413E18  |.  8B4424 18     |MOV EAX,DWORD PTR SS:[LOCAL.7]
00413E1C  |.  0FB64C24 4C   |MOVZX ECX,BYTE PTR SS:[ARG.5]
00413E21  |.  83E0 0F       |AND EAX,0000000F
00413E24  |.  99            |CDQ
00413E25  |.  0FA4C2 09     |SHLD EDX,EAX,9
00413E29  |.  C1E0 09       |SHL EAX,9
00413E2C  |.  0BC1          |OR EAX,ECX
00413E2E  |.  33DB          |XOR EBX,EBX
00413E30  |.  0BD3          |OR EDX,EBX
00413E32  |.  0FA4C2 14     |SHLD EDX,EAX,14
00413E36  |.  C1E0 14       |SHL EAX,14
00413E39  |.  8BC8          |MOV ECX,EAX
00413E3B  |.  8B4424 1C     |MOV EAX,DWORD PTR SS:[LOCAL.6]
00413E3F  |.  83E0 1F       |AND EAX,0000001F
00413E42  |.  25 FFFF0FF0   |AND EAX,F00FFFFF
00413E47  |.  0BC8          |OR ECX,EAX
00413E49  |.  8B4424 30     |MOV EAX,DWORD PTR SS:[LOCAL.1]
00413E4D  |.  0BD3          |OR EDX,EBX
00413E4F  |.  0FA4CA 01     |SHLD EDX,ECX,1
00413E53  |.  83E0 01       |AND EAX,00000001
00413E56  |.  03C9          |ADD ECX,ECX
00413E58  |.  25 C1FF1FE0   |AND EAX,E01FFFC1
00413E5D  |.  0BC8          |OR ECX,EAX
00413E5F  |.  0FB64424 5C   |MOVZX EAX,BYTE PTR SS:[ARG.9]
00413E64  |.  0BD3          |OR EDX,EBX
00413E66  |.  0FA4CA 08     |SHLD EDX,ECX,8
00413E6A  |.  25 FFC0FF1F   |AND EAX,1FFFC0FF
00413E6F  |.  C1E1 08       |SHL ECX,8
00413E72  |.  0BC8          |OR ECX,EAX
00413E74  |.  83E3 E0       |AND EBX,FFFFFFE0
00413E77  |.  0BD3          |OR EDX,EBX
00413E79  |.  8BC1          |MOV EAX,ECX
00413E7B  |.  8BCA          |MOV ECX,EDX
00413E7D  |.  8B5424 3C     |MOV EDX,DWORD PTR SS:[ARG.1]
00413E81  |.  0FA4C1 0F     |SHLD ECX,EAX,0F
00413E85  |.  33DB          |XOR EBX,EBX
00413E87  |.  C1E0 0F       |SHL EAX,0F
00413E8A  |.  81E2 FF7F0000 |AND EDX,00007FFF
00413E90  |.  81E3 FF0FF0FF |AND EBX,FFF00FFF
00413E96  |.  0BCB          |OR ECX,EBX
00413E98  |.  81E6 FF0F10FE |AND ESI,FE100FFF
00413E9E  |.  0BCE          |OR ECX,ESI
00413EA0  |.  8B7424 54     |MOV ESI,DWORD PTR SS:[ARG.7]
00413EA4  |.  81E2 FF7F00E0 |AND EDX,E0007FFF
00413EAA  |.  0BC2          |OR EAX,EDX
00413EAC  |.  8B14AE        |MOV EDX,DWORD PTR DS:[EBP*4+ESI]
00413EAF  |.  81E7 000000E0 |AND EDI,E0000000
00413EB5  |.  0BC7          |OR EAX,EDI
00413EB7  |.  8B7C24 10     |MOV EDI,DWORD PTR SS:[LOCAL.9]
00413EBB  |.  8902          |MOV DWORD PTR DS:[EDX],EAX
00413EBD  |.  8B4424 20     |MOV EAX,DWORD PTR SS:[LOCAL.5]
00413EC1  |.  894A 04       |MOV DWORD PTR DS:[EDX+4],ECX
00413EC4  |.  8304AE 08     |ADD DWORD PTR DS:[EBP*4+ESI],8
00413EC8  |.  8BC8          |MOV ECX,EAX
00413ECA  |.  C1E9 02       |SHR ECX,2
00413ECD  |.  014C24 3C     |ADD DWORD PTR SS:[ARG.1],ECX
00413ED1  |.  03F8          |ADD EDI,EAX
00413ED3  |.  8B4424 28     |MOV EAX,DWORD PTR SS:[LOCAL.3]
00413ED7  |>  8B4C24 24     |MOV ECX,DWORD PTR SS:[LOCAL.4]
00413EDB  |.  41            |INC ECX
00413EDC  |.  83C0 04       |ADD EAX,4
00413EDF  |.  897C24 10     |MOV DWORD PTR SS:[LOCAL.9],EDI
00413EE3  |.  894C24 24     |MOV DWORD PTR SS:[LOCAL.4],ECX
00413EE7  |.  894424 28     |MOV DWORD PTR SS:[LOCAL.3],EAX
00413EEB  |.  3B4C24 34     |CMP ECX,DWORD PTR SS:[LOCAL.0]
00413EEF  |.^ 0F82 1BFEFFFF \JB 00413D10
00413EF5  |.  5F            POP EDI
00413EF6  |.  5E            POP ESI
00413EF7  |.  5D            POP EBP
00413EF8  |.  5B            POP EBX
00413EF9  |.  83C4 28       ADD ESP,28
00413EFC  |.  C3            RETN
00413EFD  |>  55            PUSH EBP
00413EFE  |.  68 4C448200   PUSH OFFSET iw5mp.0082444C               ; ASCII "R_AddXModelSurfacesCamera"
00413F03  |.  6A 1B         PUSH 1B
00413F05  |.  E8 C61A0700   CALL 004859D0 ->DrawXModelSkinCached OFFSET
00413F0A  |.  83C4 0C       ADD ESP,0C
00413F0D  |>  5F            POP EDI
00413F0E  |.  5E            POP ESI
00413F0F  |.  5D            POP EBP
00413F10  |.  5B            POP EBX
00413F11  |.  83C4 28       ADD ESP,28
00413F14  \.  C3            RETN

#define DrawXModelSkinCached 004859D0

[cucuYeL]

Both. They are, after all, running on the same version.

Though, if this is true, are the offsets in the OP for IW5M too?

[Kenshin13]

Though, if this is true, are the offsets in the OP for IW5M too?

..............Yes. I said that didn't I?

[Kenshin13]

Simple Name ESP:

*(BYTE*)0x00588A31 = 0x85;

Or

*(DWORD*)0x00588A30 = 0x90909090;
*(short*)0x00588A35 = 0x9090;

Have fun!

GIVE ME CREDITS LEECHERS

[Kenshin13]

jump_stepSize .............. 0x6DA6C8

Server sided ofc.

[Kenshin13]

SinglePlayer:

CVar Hash Table ................. 0x1B6ED90

[Papil]

thirdPerson
=========

*(BYTE*)(*(DWORD*)(0x8DAF6C) + 0xC) = 1;//the Cvar  1 = ON and 0 = OFF  "credi papil, idapro"

[billy100]

how do i use these
with cheat engine
Code:
Game Version.............1.4.382
Version Build Date.......Thu Jan 19 2012 11:09:49AM
No Recoil................0x0054F8F9
Refdef...................0x0096A280
CG.......................0x008FF100
CGS......................0x008FABA0
Entity...................0x00A08630
Entity Size..............0x000001F8
ClientInfo...............0x009FC748
ClientInfo Size..........0x00000560
Maxtrix..................0x010637BC
PlayerSnap...............0x008FF100
KButtons.................0x00B39EE0
RenderDevice.............0x05F96FA8
RegisterFont.............0x004FB960
ETC..

[wildkillerr]

This thread will be where you can post all the addresses/offsets.


READ:
Before you post in this thread be aware of:
Any posts that don't contain addresses/offsets will be DELETED
Be sure that the addresses/offsets are working
Try to post them as clean as possible (Don't post the address/offset in the middle of a text, make it easy found and the function)

---

Posted by -InSaNe-

Offsets for 1.4.382 (TeknoMW3)

Game Version.............1.4.382
Version Build Date.......Thu Jan 19 2012 11:09:49AM
No Recoil................0x0054F8F9;

Credits to CypherPresents, g0dly, King-Orgy, raiders, cardoow, poink, and master131.

Can You Tell Me Value Of No Recoil And Type(byte , float or 4-byte) Of That Pointer??

[hkKenshin]

Been messing around in SP the past few days.

 

struct dvar_s
{
 char* dvarName; //0x0000 Pointer to the dvar name
 int dvarHashID; //0x0004 The ID you can register a dvar with
 byte bType; //0x0008 Determines if it's a byte, vec2_t, vec3_t etc.
 byte zero0; //0x0009 No idea why but the game sets this to 0.
 char __pad[2]; //0x000A 
 int ValueDefault0; //0x000C This is where values start from. It can be either an integer or a float.
 int ValueSecond0; //0x0010  Second value is placed here (if required) and so on.
 int ValueThird0; //0x0014 
 int ValueFourth0; //0x0018 
 int ValueDefault1; //0x001C Here just stores copies of the above
 int ValueSecond1; //0x0020 
 int ValueThird1; //0x0024 
 int ValueFourth1; //0x0028 
 int ValueDefault2; //0x002C 
 int ValueSecond2; //0x0030 
 int ValueThird2; //0x0034 
 int ValueFourth2; //0x0038 
 int MinimumValue; //0x003C Minimum value the dvar can take ( If min and max are set to 0, it has no limit. )
 int MaximumValue; //0x0040 Maximum value the dvar can take
 int zero1; //0x0044 And this is another value the game sets to zero
 int* DvarBase; //0x0048 The pointer to the base of the structure.
};//Size=0x004C

Current Registered Dvars: 0x1C42398
Max Dvars: 4096
Dvar Base Structure: 0x1C473C0
Dvar Hash Table: 0x1C423C0

Wanna make your own dvars? Just call this function.

dvar_s* (__cdecl* RegisterDvar)(char *dvarName, char DvarType, int HashDvarID, int FirstValue, float SecondValue, float ThirdValue, float FourthValue, int MinValue, int MaxValue) = (dvar_s* (__cdecl*)(char*, char, int, int, float, float, float, int, int))0x611570;

Then:

dvar_s* AimbotActive = RegisterDvar("aimbot_active", 0, 0x1337, 1, 0, 0, 0, 0, 1);

if(AimbotActive->DefaultValue0) cAim.Aimbot();

Credits: Kenshin13 & -InSaNe-

[hkKenshin]

Started reversing the second entity structure. Haven't reached very far.

class EntityInfo;
class eInfo;
class BodyInfo;
class ModelLoadout;
class eCheck;

class EntityInfo
{
public:
char _0x0000[116];
	DWORD TimeAlive; //0x0074 
char _0x0078[32];
	eInfo* Info; //0x0098 
};//Size=0x009C

class eInfo
{
public:
	BodyInfo* BodyInformation; //0x0000
};//Size=0x0004

class BodyInfo
{
public:
	char* GunSkin; //0x0000 
	char* SecondaryGun; //0x0004 
char _0x0008[300];
	char* HeadType; //0x0134 
char _0x0138[304];
	char* HatType; //0x0268 
char _0x026C[304];
	char* BodyType; //0x039C 
char _0x03A0[156];
	ModelLoadout* LoadOut; //0x043C 
};//Size=0x0440

class ModelLoadout
{
public:
	char* BodyLoad; //0x0000 
};//Size=0x0004

class eCheck
{
public:
	char* HatModel;
	DWORD eChecksum; //0x0004
};//Size=0x0008

Here's how to find it:

EntityInfo* GetEntityInfoFromIndex(int Index)
{
	short* Start = (short*)0x16E4738;
	return (EntityInfo*)(0x1695628 + ( 0x9C * Start[Index]));
}

An example:

printf("Entity Gun: %s", GetEntityInfoFromIndex(1337)->Info->BodyInformation->GunSkin);

There's alot more in this. ALOT more.

SP Offsets
Feel free to reverse the rest.

[hkKenshin]

I never really explained how to make your own dvars much. So I'll do this for you beginners since I'm bored.

First, define the RegisterDvar function

dvar_s* (__cdecl* RegisterDvar)(char *dvarName, char DvarType, int HashDvarID, int FirstValue, float SecondValue, float ThirdValue, float FourthValue, int MinValue, int MaxValue) = (dvar_s* (__cdecl*)(char*, char, int, int, float, float, float, int, int))0x611570;

RegisterDvar returns a pointer to the start of the dvar structure you registered. It also increments the CurrentDvars pointer and adds it's address to the DvarHashTable

Let me explain the parameters now:

char *dvarName - Pretty simple, this is the dvar name you want to create. You probably shouldn't create a copy of an existing dvar ( eg. cg_fov )...
char DvarType - This is a byte containing the type of the dvar. ( See below )
int HashDvarID - I haven't really found a use for this so far. As far as I can tell, it's a value that isn't really used but is stored in the structure. It can be anything.
int FirstValue - Either an integer or a float/double depending on what type of dvar you want to create. This is the first value.
float SecondValue-FourthValue - These contain other parameters depending on if you choose a vec4_t etc.
int MaxValue - Maximum value a dvar can take. If it exceeds this, the dvar is set to the max value.
int MinValue - Minimum value the dvar will take. Same as above.

Dvar Types: ( Courtesy BaberZz )

typedef enum
{
    TYPE_BOOL    = 0,
    TYPE_FLOAT    = 1,
    TYPE_VEC2    = 2,
    TYPE_VEC3    = 3,
    TYPE_VEC4    = 4,
    TYPE_INT    = 5,
    TYPE_ENUM    = 6,
    TYPE_STRING    = 7,
    TYPE_COLOR    = 8,
    TYPE_VEC3_2    = 9
} Dvar_Type;

Creating a dvar is simple now:

dvar_s* FOVOVERRIDE = RegisterDvar("fov_override", 1, 0x1337, 90, 0, 0, 0, 65, 150);

And you can simply access the dvar's value:

SetDvar("cg_fov", FOVOVERRIDE->FirstValue);

I was bored.